The Drupal Cookies module has a vulnerability in its Video submodule where it insufficiently validates the 'data-cookies-video-blazy-src' attribute before converting it back to a 'src' attribute for Blazy iframes. This flaw could allow an attacker with specific permissions to inject content that affects all users. The vulnerability is fixed in version 1.2.17.